The Signal

The ubiquity of remote hiring has become a primary attack vector for state-sponsored actors, with North Korean entities now executing nearly half of all cyberattacks against US tech firms. The shift from blunt-force hacking to deep-fake-enabled social engineering means that standard perimeter defenses are insufficient against modern identity-based threats.

What Happened

CrowdStrike’s latest intelligence report confirms that North Korean operatives accounted for approximately 47% of state-backed attacks on US technology companies between April 2025 and March 2026. The group, identified as “Famous Chollima,” bypasses traditional firewalls by assuming the identities of legitimate remote IT workers and recruiters. These actors deploy sophisticated deepfake imagery and stolen credentials to secure internal network access, ultimately funnelling salaries back to the North Korean regime to circumvent international sanctions.

Why It Matters

First-order: Your remote hiring funnel is now a high-risk security endpoint. Traditional background checks are failing against synthetic identities powered by generative AI, allowing threat actors to gain authorized access to your codebase and internal repositories.

Second-order: Expect a massive contraction in the tolerance for anonymous remote work. Investors will likely require more rigorous identity-verification protocols and “proof-of-person” mandates during technical due diligence. This significantly increases the operational friction for global teams.

Third-order: This marks a transition from network-layer security toward a zero-trust model where every single endpoint and contributor identity must be continuously re-verified. Companies that cannot prove the veracity of their workforce will face higher insurance premiums and regulatory scrutiny.

What To Watch

  • The “Proof-of-Person” Standard: Watch for the emergence of mandatory video-verified identity documentation during onboarding and the rise of specialized decentralized identity (DID) services for remote developers.
  • Increased SOC/IT Audit Requirements: Expect insurance providers and enterprise customers to demand specific controls—such as hardware-backed MFA—as a requirement for B2B contracts.
  • Deepfake Detection Tooling: Rapid adoption of AI-native identity verification platforms will become table stakes for HR tech stacks.